# Kerberos Network Authentication Dialog Manual

Kerberos Network Authentication Dialog is a small helper that monitors and refreshes your Kerberos ticket.

2009
Guido Günther
Guido Günther

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License (GFDL), Version 1.1 or any later version published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. You can find a copy of the GFDL at this link or in the file COPYING-DOCS distributed with this manual.

This manual is part of a collection of GNOME manuals distributed under the GFDL. If you want to distribute this manual separately from the collection, you can do so by adding a copy of the license to the manual, as described in section 6 of the license.

Many of the names used by companies to distinguish their products and services are claimed as trademarks. Where those names appear in any GNOME documentation, and the members of the GNOME Documentation Project are made aware of those trademarks, then the names are in capital letters or initial capital letters.

DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT ARE PROVIDED UNDER THE TERMS OF THE GNU FREE DOCUMENTATION LICENSE WITH THE FURTHER UNDERSTANDING THAT:

1. DOCUMENT IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS FREE OF DEFECTS MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY, ACCURACY, AND PERFORMANCE OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS WITH YOU. SHOULD ANY DOCUMENT OR MODIFIED VERSION PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT THE INITIAL WRITER, AUTHOR OR ANY CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER; AND

2. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE AUTHOR, INITIAL WRITER, ANY CONTRIBUTOR, OR ANY DISTRIBUTOR OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR LOSSES ARISING OUT OF OR RELATING TO USE OF THE DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES.

Jonathan
Blandford
rjb@redhat.com
Guido
Günther
agx@sigxcpu.org
3.0
May 2009

Guido Günther agx@sigxcpu.org

This manual describes how to use the Kerberos Network Authentication Dialog to manage your Kerberos tickets.

## Odziv

To report a bug or make a suggestion regarding this package or this manual, use GNOME Gitlab.

## Uvod

Kerberos Network Authentication Dialog is an applet for the GNOME desktop that monitors and refreshes your Kerberos ticket. It pops up reminders when the ticket is about to expire.

Once you have acquired a Kerberos ticket - be it via GDM or via the applet itself - the applet will handle the ticket's renewal until it expires. It can also be used to destroy (remove) the credential cache, to acquire a ticket with different options or to switch to another principal.

## Usage

Kerberos Network Authentication Dialog is usually started in GNOME startup, but you can manually start Kerberos Network Authentication Dialog by doing:

Command line

  Type `krb5-auth-dialog`, then press Return:

From now on Kerberos Network Authentication Dialog will display notifications when the status of your Kerberos tickets changes. If you want to get an overview of the current tickets just activate Kerberos Network Authentication Dialog by clicking on the notification or by starting it again as described above.

## Notification Messages

When Kerberos Network Authentication Dialog has started, the following notifications may be displayed.

### Kerberos credentials valid

You just acquired a valid Kerberos ticket that can be used to authenticate to network services.

#### Notification when Kerberos credentials become valid

### Kerberos credentials expiring

Your Kerberos credentials are about to expire. You can left click on the tray applet to refresh them.

#### Notification when Kerberos credentials expiring

### Kerberos credentials expired

Your Kerberos credentials just expired. They can no longer be used to authenticate to network services.

#### Notification when Kerberos credentials expired

## Preferences

You can set preferences by selecting "Preferences" from the window's hamburger menu.

### Kerberos Principal Preferences

Dialog Element | Description
--- | ---
Kerberos Principal | The Kerberos principal to use. Leave blank to use you current username. If you change this setting you have to destroy the credential cache before these setting takes effect.
PKINIT Userid | The principals public/private/certificate identifier. Leave empty if not using PKINIT. To enable using a security token add the path to the pkcs11 Library here, e.g. "PKCS11:/usr/lib/opensc/opensc-pkcs11.so"
PKINIT anchors | Path to CA certificates used as trust anchors for pkinit. You only need to set this if it hasn't been set up globally in `/etc/krb5.conf`
forwardable | Whether the requested Kerberos ticket should be forwardable. Changing this setting requires to you to reauthenticate by left clicking on the tray icon and entering your password.
renewable | Whether the requested Kerberos ticket should be renewable. Changing this setting requires to you to reauthenticate by left clicking on the tray icon and entering your password.
proxiable | Whether the requested Kerberos ticket should be proxiable. Changing this setting requires to you to reauthenticate by left clicking on the tray icon and entering your password.
Warn .. minutes before ticket expiry | Notifications that your credentials are about to expire will be sent that many minutes before expiry.